如何通过基本身份验证确保 Spring Cloud Eureka 服务的安全？

我在同一主机上设置了多个尤里卡服务器实例。他们使用主机名 eureka-primary、 secondary 和 tertiary，这些主机名在主机文件中定义为 localhost 别名，一切都工作正常 - 它们都是可见的，并且可以作为不同的实例相互使用。

当我尝试使用以下方法保护尤里卡实例时，问题就开始了basic auth和这个。这个想法是添加 spring security 依赖项，指定 eureka 服务器上的安全用户和密码，并将这些凭据放在defaultZoneurl（配置如下），但这似乎不起作用。

Eureka 实例甚至无法相互注册，当我尝试访问 Eureka Web 门户时，系统会提示我输入登录表单，然后重定向到仪表板。所有仪表板都工作正常，需要凭据才能访问。

我正在使用Spring CloudFinchley.RC1带弹簧靴2.0.1.RELEASE和相同版本的spring-boot-starter-security and spring-cloud-starter-netflix-eureka-server.

Eureka服务器pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>rs.microservices</groupId>
    <artifactId>eurekaServer</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>eurekaServer</name>
    <description>Demo project for Spring Boot</description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.1.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
        <spring-cloud.version>Finchley.RC1</spring-cloud.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-netflix-eureka-server</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
    </dependencies>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

    <repositories>
        <repository>
            <id>spring-milestones</id>
            <name>Spring Milestones</name>
            <url>https://repo.spring.io/milestone</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>
</project>

Eureka服务器应用程序.yml

---
spring:
  security:
    user:
      name: admin
      password: admin
  profiles: primary
  application:
    name: eureka-server-clustered   
server:
  port: 8011  
eureka:
  instance:
    hostname: eureka-primary       
  client:
    registerWithEureka: true
    fetchRegistry: true        
    serviceUrl:
      defaultZone: http://admin:admin@eureka-secondary:8012/eureka/,http://admin:admin@eureka-tertiary:8013/eureka/

---
spring:
  security:
    user:
      name: admin
      password: admin
  profiles: secondary
  application:
    name: eureka-server-clustered      
server:
  port: 8012
eureka:
  instance:
    hostname: eureka-secondary       
  client:
    registerWithEureka: true
    fetchRegistry: true        
    serviceUrl:
      defaultZone: http://admin:admin@eureka-primary:8013/eureka/,http://admin:admin@eureka-tertiary:8011/eureka/

---
spring:
  security:
    user:
      name: admin
      password: admin
  profiles: tertiary
  application:
    name: eureka-server-clustered      
server:
  port: 8013
eureka:
  instance:
    hostname: eureka-tertiary       
  client:
    registerWithEureka: true
    fetchRegistry: true    
    serviceUrl:
      defaultZone: http://admin:admin@eureka-primary:8011/eureka/,http://admin:admin@eureka-secondary:8012/eureka/   

微服务bootstrap.yml

spring:
  application:
    name: someService
server:
  port: 0 
eureka:  
  client:
    registerWithEureka: true
    fetchRegistry: true
    service-url:
      defaultZone: http://admin:admin@localhost:8011/eureka/,http://admin:admin@localhost:8012/eureka/,http://admin:admin@localhost:8013/eureka/

我究竟做错了什么？

*EDIT

我已经找到了多种像这样的解决方案在 Spring 云中保护 Eureka https://stackoverflow.com/questions/28974752/securing-eureka-in-spring-cloud?rq=1，但他们都没有真正解决我的问题 - 正如你所看到的，我们的配置是相同的。

Solved!

TL;DR问题是CSRF由于某种原因，spring 无法对配置的用户进行身份验证application.yml

所以我必须重写配置方法WebSecurityConfigurerAdapter禁用 csrf 并创建 inMemory 用户。还从 application.yml 中删除了 spring.security.user 属性。

尤里卡服务器application.yml现在看起来像：

---
spring:
  profiles: primary
  application:
    name: eureka-server-clustered   
server:
  port: 8011  
eureka:
  instance:
    hostname: eureka-primary       
  client:
    registerWithEureka: true
    fetchRegistry: true        
    serviceUrl:
      defaultZone: http://admin:admin@eureka-secondary:8012/eureka,http://admin:admin@eureka-tertiary:8013/eureka
---
spring:
  profiles: secondary
  application:
    name: eureka-server-clustered      
server:
  port: 8012
eureka:
  instance:
    hostname: eureka-secondary       
  client:
    registerWithEureka: true
    fetchRegistry: true        
    serviceUrl:
      defaultZone: http://admin:admin@eureka-primary:8013/eureka,http://admin:admin@eureka-tertiary:8011/eureka

---
spring:
  profiles: tertiary
  application:
    name: eureka-server-clustered     
server:
  port: 8013
eureka:
  instance:
    hostname: eureka-tertiary       
  client:
    registerWithEureka: true
    fetchRegistry: true    
    serviceUrl:
      defaultZone: http://admin:admin@eureka-primary:8011/eureka,http://admin:admin@eureka-secondary:8012/eureka  

新创建的WebSecurityConfig class:

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
        .passwordEncoder(NoOpPasswordEncoder.getInstance())
        .withUser("admin").password("admin")
        .authorities("ADMIN");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .disable()
            .authorizeRequests()
              .anyRequest().authenticated()
              .and()
              .httpBasic();
    }
}